 
        "Multiple providers with empty results using ignore_case=false option"
        ["prov1"] {"options[provider][ignore_case]" false} []))))
+
+(deftest acl-search-multiple-criteria
+  (let [token (e/login (u/conn-context) "user1")
+        group1 (u/ingest-group token {:name "group1"} ["user1"])
+        group2 (u/ingest-group token {:name "group2"} ["user2"])
+        acl1 (ingest-acl token (system-acl "SYSTEM_AUDIT_REPORT"))
+        acl2 (ingest-acl token (assoc (system-acl "METRIC_DATA_POINT_SAMPLE")
+                                      :group_permissions
+                                      [{:user_type "registered" :permissions ["create"]}]))
+        acl3 (ingest-acl token (assoc (system-acl "ARCHIVE_RECORD")
+                                      :group_permissions
+                                      [{:group_id (:concept_id group1) :permissions ["create"]}]))
+        acl4 (ingest-acl token (assoc (provider-acl "OPTION_DEFINITION")
+                                      :group_permissions
+                                      [{:user_type "registered" :permissions ["create"]}]))
+        acl5 (ingest-acl token (assoc (provider-acl "OPTION_ASSIGNMENT")
+                                      :group_permissions
+                                      [{:group_id (:concept_id group2) :permissions ["create"]}]))
+        acl6 (ingest-acl token (assoc-in (assoc (provider-acl "OPTION_ASSIGNMENT")
+                                                :group_permissions
+                                                [{:group_id (:concept_id group2) :permissions ["create"]}])
+                                         [:provider_identity :provider_id] "PROV2"))
+        acl7 (ingest-acl token (assoc (catalog-item-acl "All Collection")
+                                      :group_permissions
+                                      [{:group_id (:concept_id group1) :permissions ["create"]}
+                                       {:user_type "registered" :permissions ["create"]}]))
+        acl8 (ingest-acl token (assoc (catalog-item-acl "All Granules")
+                                      :group_permissions
+                                      [{:group_id (:concept_id group1) :permissions ["create"]}]))
+        acl9 (ingest-acl token (assoc-in (assoc (catalog-item-acl "All Granules PROV2")
+                                                :group_permissions
+                                                [{:group_id (:concept_id group2) :permissions ["create"]}])
+                                         [:catalog_item_identity :provider_id] "PROV2"))
+
+        first-result [acl7]
+        second-result [acl4 acl7]
+        third-result [acl4 acl5 acl6 acl7 acl9]
+        group2-concept-id (:concept_id group2)]
+    (u/wait-until-indexed)
+    (testing "Search with every criteria"
+      (are3 [provider-ids permitted-groups identity-types users acls]
+        (let [response (ac/search-for-acls (u/conn-context) {:provider provider-ids
+                                                             :permitted-group permitted-groups
+                                                             :identity-type identity-types
+                                                             :permitted-user users})]
+          (is (= (acls->search-response (count acls) acls)
+                 (dissoc response :took))))
+        "Four criteria catalog item search"
+        ["PROV1"] ["registered"] ["catalog_item"] ["user1"] first-result
+
+        "One criteria is wrong"
+        ["PROV1"] ["guest"] ["catalog_item"] ["user1"] []
+
+        "Multiple search criteria with only permitted groups being registered and guest but user1 being specified as permitted user"
+        ["PROV1" "PROV2"] ["registered" "guest"] ["catalog_item" "provider"] ["user1"] second-result
+
+        "Multiple search criteria with no permitted group specified and permitted users set to user2"
+        ["PROV1" "PROV2"] [""] ["catalog_item" "provider"] ["user2"] third-result))))

              or by any provider where multiple are specified"
      (are3 [provider-ids acls]
        (let [response (ac/search-for-acls (u/conn-context) {:provider provider-ids})]
          (= (acls->search-response (count acls) acls)
             (dissoc response :took)))

        "Single provider with multiple results"
        ["PROV1"] prov1-acls

        "Single provider with single result, case-insensitive"
        ["prov3"] prov3-acls

        "Provider that doesn't exist"
        ["NOT_A_PROVIDER"] []))

    (testing "Search ACLs by provider with options"
      (are3 [provider-ids options acls]
       (let [response (ac/search-for-acls (u/conn-context)
                                          (merge {:provider provider-ids} options))]
         (is (= (acls->search-response (count acls) acls)
                (dissoc response :took))))

       "Multiple providers with multiple results using ignore_case=false option"
       ["PROV1"] {"options[provider][ignore_case]" false} prov1-acls
